CVE-2026-81648: CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CryptoPayment Gateway (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.2.2 - Operational
Review for compromise indicators and recover/rotate any stored wallet credentials that may have been exposed in cleartext via the vulnerable unauthenticated AJAX endpoint.
Event History
Frequently Asked Questions
Which installations are affected?
WordPress sites using the CryptoPayment Gateway plugin versions 1.2.1 through 1.2.2 are affected.
Does exploitation require an account or user interaction?
No. The vulnerable AJAX endpoint can be invoked by an unauthenticated attacker, with no account or user interaction required.
What could an attacker do through the exposed endpoint?
An attacker can invoke administrative operations including deleting arbitrary server files, overwriting payment gateway configuration, and recovering stored wallet credentials in cleartext.